An interesting article was written by Dries (Drupal Founder) and others.

Good thread on reddit too: https://old.reddit.com/r/Wordpress/comments/1fup9gb/solving_...

AWS and Digital Ocean run local Ubuntu download servers and do not depend on Canonical to run their business. WPEngine is a hosted service and could make very simple changes to download updates from their own servers.

It's a very nuanced thing. The world could be very different today. There would have been very little pushback against Matt's crusade if he'd just thought about making sure service to users was uninterrupted.

Instead he dragged 1.5 million sites into the middle of this in a way that made him look like the bad guy.

I hope that WordPress will continue to be open and Matt will continue to lead it, but he just cost himself a lot mindshare. That's why I asked him to explain why he made the choice he did.

Hopefully he has a PR person who is advising him on how to handle this situation. Were it me, I would say something like: "My passion for keeping WordPress open source got the better of me and I made a hasty decision which caused problems for end users. I've learned from this and it's not a mistake I will ever repeat. Going forward if there are changes to how we administer WPorg's services we will discuss them with the community and announce them well in advance because we want them to be rock solid and reliable for all of the millions of websites which depend on them."

This type of statement would go over well with a lot of people including the big enterprise customers who are depending on WP, who Matt really wants and who are constantly being courted by WP's competitors. In followup messaging you can reiterate all the strengths of open source e.g. how it reduces vendor lock-in.

But what do I know, I've only sold a couple million dollars worth of WP contracts, meanwhile Matt is worth 400 of those big M's. :)

According to Automattic they had been in discussions for 20 months. Your anger should be with WPEngine for taking your money while knowing full well their service depended on servers ran by a company they were on (best case) shaky terms with.

Up until about 8 months ago, Bluehost (another big paid hoster of WordPress sites) ran its own plugin mirror with no issues: https://github.com/bluehost/pluginmirror

They could have give a warning 20 months ago that this may happen and then this would not be a thing.

Or is the 20 months thing just completely irrelevant to the point that Automattic should've given a heads up before cutting off plug-in updates

I mean yeah, companies should have contingency plans for things that are extraordinarily rare but let's be reasonable about it. No one, including you, saw this coming.

I challenge you to find a single blog post, tweet or HN/Reddit comment that suggests Matt could one day shut off wp.org access to a single company running 1.5 million sites without any notice to that company, or the community members who will be affected. It's unconscionable. Or at least it was.

Be reasonable.

https://wordpressfoundation.org/trademark-policy/#:~:text=If....

This all kicked off when he publicly accused WP Engine of “butchering” WordPress for disabling revisions:

> What WP Engine gives you is not WordPress, it’s something that they’ve chopped up, hacked, butchered to look like WordPress, but actually they’re giving you a cheap knock-off and charging you more for it.

— https://wordpress.org/news/2024/09/wp-engine/

Disabling revisions is a configuration change. This is the simplest possible change you could make, and it’s unacceptable in his eyes.

Making WordPress contact something other than api.wordpress.org requires altering the codebase. Making this configurable is something he has explicitly rejected:

> Why would I build that? The built-in source works great, for tens of millions of servers.

— https://news.ycombinator.com/item?id=41676885

So according to Mullenweg:

- If WP Engine alters WordPress, even just to alter its configuration, they are “butchering” it.

- If WP Engine doesn’t alter WordPress and leaves it pointing at api.wordpress.org, they are unfairly using community resources.

– Huge numbers of people using api.wordpress.org is actually “great” and scales to tens of millions of servers.

As far as I can see, he doesn’t have a consistent position. He’s just grabbing hold of the nearest accusation that he thinks will harm WP Engine in the heat of the moment, regardless of what he has previously claimed or who else it hurts.

Actually this is wrong. Yes the constant WP_POST_REVISIONS exists. But WP Engine has disabled this constant. They do in fact "butcher" WordPress in the sense that they remove a feature, you can't turn it back on by yourself, and you need to talk to their support to get a limited version of it re-enabled by them.

Add to that, revisions are a big deal for a certain type of customer. Say, an enterprise scale publisher for example who has built an extensive publishing workflow around WP. (Hacker News consistently underestimates how massive some WordPress installs are; the scale of the world's biggest publishers, many of whom rely on WordPress, blows your nice little startup out of the water.)

So I am aware of a case or two where this actually became a negotiating point in an enterprise contract. The customer was entirely unaware that revisions were just a free thing built into WP, and it influenced the resulting contract and cost. Dirty dirty on WPE's side, really.

BTW this is documented at https://wpengine.com/support/platform-settings/ and you can see on that page that they limit their environment in many other ways. In the abstract this may not be a huge problem, hosts have costs and security and various limitations to think about. In my personal experience there are limitations which are not listed on that page and those are more frustrating.

Intel, Google, even Microsoft etc. develop improvements to Linux knowing full well that their competitors will also get access to those improvements. For sure it's disappointing that WP Engine contributes almost no time to Core.

Oh, I remember now. I was wondering why ACF didn't become part of the core.

We can have debates about whether this philosophy is the right one or not but there's no point. It's what it is and it makes fixing things like this simply not possible.

It's a well-engineered product whether you want to accept it or not. Unlike more than half of the tech world that's unprofitable and is just a fart in the wind of tech memory.

WP is a well-delivered product that works well for its user base in most situations. Plenty of code is well-marketed, profitable, and fulfills users' needs, but not well-engineered.

By the way, I know the PHP gripe is contentious, but it's not the reason why I think WP is badly engineered, it's just the reason it was easier to engineer it badly.

See https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ for more details on PHP.

One excerpt from that page:

There is a whole lot of action at a distance. Consider this code, taken from the PHP docs somewhere.

@fopen('http://example.com/not-existing-file', 'r');

What will it do?

If PHP was compiled with --disable-url-fopen-wrapper, it won’t work. (Docs don’t say what “won’t work” means; returns null, throws exception?) Note that this flag was removed in PHP 5.2.5.

If allow_url_fopen is disabled in php.ini, this still won’t work. (How? No idea.)

Because of the @, the warning about the non-existent file won’t be printed.

But it will be printed if scream.enabled is set in php.ini.

Or if scream.enabled is set manually with ini_set.

But not if the right error_reporting level isn’t set.

If it is printed, exactly where it goes depends on display_errors, again in php.ini. Or ini_set.

I can’t tell how this innocuous function call will behave without consulting compile-time flags, server-wide configuration, and configuration done in my program. And this is all built in behavior.

For years, wordpress stored user session data in 'wp_options'. Moderately trafficked sites needed to come up with regular purging hacks to 'clean' their wp_options table. Why? Session data is not an 'option', it's... session data. Make a database table called 'wp_sessions'. Transient 'cached' data also... in 'wp_options'. This was not an example of 'good engineering'.

This is just one of many examples of suboptimal tech decisions. Some have been mitigated, updated or otherwise 'fixed' over the years, so they may not be relevant any longer. It's a very popular and widely used platform despite some poor development and engineering choices, and perhaps even in some cases because of these poor choices, but that doesn't make them good engineering.

If the parent poster is secretly Linus Torvalds, do you walk away in shame because he HAS done a project with better engineering? Or are the criticisms, perhaps, objectively valid or invalid, and worth engaging with regardless of the merits of the person making the criticisms?

What is invalid, specifically, about that blog post?

Although I think the exception there is security (and yes I know many will say clean and well engineered code is secure code). Security has to be solid or it will impact too many people negatively.

Yeah good luck with that. Something so deeply embedded in WordPress Core impossible to improve upon.

I do know they exist of course, Sony being one.

I’m coding up a little something that I feel is more modern and superior compared to WP, and I’d like to learn what their business requirements and use cases are that keep them on WP.

Thanks in advance!

Something that feels powerful and safe; like WP of 10 to 15 years ago.

Here's a nice example: https://github.com/WordPress/WordPress/blob/92d9e70f849c337c...

It's an example of the kind of backwards compatibility WordPress needs to deal with the myriad of crazy content generated by people (and plugins!) over the years. Often this gets very chatty and very inefficient.

Besides backwards compatibility, this codebase grew like a jungle, with people just piling code on, not always with much forethought. Part of it's due to the limitations of PHP in the old days, and of course it's inherent with projects of this size, but there are varying degrees of messiness. WordPress is an example of a project that started out too messy and only became more messy over time.

Just to pile on: the WPDB class is another example of continued messiness. The first thing I do whenever I write a plugin, is to add a little database wrapper that just uses PHP PDO instead. Anything better than to deal with the hopeless, inefficient, inflexible mess that is WPDB. (To whoever wrote it: sorry mate!)

Edit: this guy said it better: https://news.ycombinator.com/item?id=41729827

Or maybe it is just fine for their use case and they are making already enough money with it...

That is something the WordPress community (albeit centralised in the WordPress.org decision makers) could have been doing for decades.

That would be Matt as the sole owner of wordpress.org, not a plural 'decision makers'

In a social media post on the platform X, he boasted that as a result of his actions, WPE is now a “distressed asset,” worth just a “fraction” of what it was before, because “[c]ustomers are leaving in droves” – calling into question whether Defendants’ motivations extend beyond mere interference and extortion, and are in fact a thinly disguised attempt to artificially drive down WPE’s valuation in hopes of acquiring it on the cheap

Its not unlikely that the gameplan all along was slander and disrupt them so much that the company would become worthless, then acquire it. He was trying to blackmail/extort WPE's CEO into coming to work for him, after all! (text message screenshots are in the lawsuit too)

I would think that is a cost-saving measure as well. A hell of a lot of that data would be downloaded by users every day. Being able to pull it locally saves all that. Also, it is faster and does provide some security.

> They do not depend on Canonical to run their business.

That depends on how you look at it. If for some odd reason Canonical vanished tomorrow, that would be a big problem for both DO and AWS.

They do rely on Canonical developing, fixing upgrading the distros.

But then Amazon does have their own in-house Linux distro, which is/used to be somewhat associated with RedHat/ Centos https://github.com/amazonlinux/amazon-linux-2023

I would expect AWs,Google etc have specific internal only distros that make up the foundation of their cloud business but that is just a guess.

To be very specific about at least one of the issues:

* The URLs pointing to the WP plugin directory on wordpress.org are hardcoded into WordPress

* If WPE forks WordPress to fix that, and continues to say they host WordPress, IANAL but they probably have a trademark violation problem on their hands.

There are certainly workarounds which exist, but it's hard for us to conclude casually on Hacker News whether they can be deployed at WP Engine scale and in compliance with whatever agreements WP Engine is bound to.

So yeah you're right about what the right thing to do is. But frequently reality is not that simple. They needed time and maybe even assistance from wporg (in helping them to be free of wporg. errrr)

But they can be changed via filters. I do that all the time to manage when certain request are being made (and making sure it's in a cron job and not a user-request).

WP Engine does run their own plugin in the instances they host, though I assume it's not obligatory. Still, every site I ever had to look at that was on WPE had it installed and enabled.

WP does come with its own CA certs, but that file could be appended (or replaced, again via filter) as well. Since they're comfortable changing things like the revision settings, I doubt this would be something they wouldn't do.

I'm not saying Matt is reasonable, but "it's not an easy thing to do" isn't true.

I think it's obvious WPE wouldn't be in the clear with Matt even if they went and hosted a mirror/cache of the WP.org packages.

[1] https://projects.propublica.org/nonprofits/organizations/205...

Automattic's associate legal counsel begs to differ [1]:

> Let’s apply this to the WordPress trademarks (also called simply “marks”). The WordPress Foundation owns the right to use the WordPress marks for non-commercial purposes. It can also sublicense out this right for particular events (e.g., WordCamps) and to people supporting the WordPress project and community. The Foundation also licensed the name WordPress to the non-profit WordPress.org, which runs a website that facilitates access to WordPress-related software.

(Take it up with them, not me.)

[1] https://automattic.com/2024/10/02/wordpress-trademarks-a-leg...

"We could not get wordpress.org being part of the foundation approved by the IRS."

https://youtu.be/OUJgahHjAKU?t=342

Automattic's legal team somehow considers it a non-profit though.

So like I said, at this point it's no different than RHEL's very stringent trademark protections, and restrictions on using their update servers (cdn.redhat.com) if you're not paying them. The only difference here is that if WP Engine was itself a non-profit, Matt wouldn't be going after them. RHEL is not as generous.

Apparently these are the new rules. If you're a for-profit entity advertising "Wordpress Hosting" instead of "Hosting with Wordpress installed" and want access to the infrastructure of wordpress.org (which costs millions of dollars a year) you now have to pay, either in cash or equivalent contributions.

Personally that seems fair. It should have come with a minimum 90 day public notice period, and the stuff about being a cancer etc. is pretty crazy. Changing marketing language and setting up your own plugin mirror like Bluehost did (https://github.com/bluehost/pluginmirror) is not the end of the world.

It is a stupid hissyfit and some bad judgments. People make mistakes.

There are far better purely technical / code issues to turn people away from WordPress, but WordPress is spectacularly popular.

I'll admit that I'd already been looking for a modern alternative. I'm a web developer, I almost exclusively write in TypeScript, something running on Node just makes more sense for me. I recently built a project on PayloadCMS and NextJS -- Payload has since integrated directly into Next's server and has a really nice "website" template to get started. I'll be using that from now on.

I think the data schema in Wordpress is decent. With the addition of Pods it has become a lot more flexible. (There were other solutions that mostly cost $$)

Most of my issues with WP has to do with the front end.

yup. I'm about to make a new site and I dont care about the platform, I just want to write. but I'm not gonna use wordpress ever again now, probably. Matt seems friendly but this is evil CEO garbage

Correction: this is Evil CEO vs Evil CEO garbage. Casting WPEngine as some sort of saint is highly inaccurate.